Rewored UPnP protocol that in essence was WSD hence it has been renamed

Cleaned up TLS code for DTLS detection by defining a new DTLS protocol

4 files changed, 35 insertions, 35 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 02d2d5ed8..45caa56ce 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -787,10 +787,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  no_master, no_master, "VMware", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS,
 			  ndpi_build_default_ports(ports_a, 903, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 902, 903, 0, 0, 0) /* UDP */);
-  ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_FREE_30, 0 /* can_have_a_subprotocol */,
-			  no_master, no_master, "FREE_30", NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK,
-			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
   ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_KONTIKI,
 			  0 /* can_have_a_subprotocol */, no_master, no_master, "Kontiki",
 			  NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -1064,6 +1060,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  no_master, "TLS", NDPI_PROTOCOL_CATEGORY_WEB,
 			  ndpi_build_default_ports(ports_a, 443, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+  ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DTLS, 1 /* can_have_a_subprotocol */, no_master,
+			  no_master, "DTLS", NDPI_PROTOCOL_CATEGORY_WEB,
+			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
   ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SSH, 0 /* can_have_a_subprotocol */,
 			  no_master, no_master, "SSH", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS,
 			  ndpi_build_default_ports(ports_a, 22, 0, 0, 0, 0) /* TCP */,
@@ -1216,18 +1216,17 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  NDPI_PROTOCOL_CATEGORY_COLLABORATIVE,
 			  ndpi_build_default_ports(ports_a, 1352, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-  ndpi_set_proto_defaults(
-			  ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SAP, 0 /* can_have_a_subprotocol */, no_master, no_master,
+  ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SAP, 0 /* can_have_a_subprotocol */, no_master, no_master,
 			  "SAP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 3201, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
   ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_GTP, 0 /* can_have_a_subprotocol */,
 			  no_master, no_master, "GTP", NDPI_PROTOCOL_CATEGORY_NETWORK,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 2152, 2123, 0, 0, 0) /* UDP */);
-  ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UPNP, 0 /* can_have_a_subprotocol */,
-			  no_master, no_master, "UPnP", NDPI_PROTOCOL_CATEGORY_NETWORK,
-			  ndpi_build_default_ports(ports_a, 1780, 0, 0, 0, 0) /* TCP */,
-			  ndpi_build_default_ports(ports_b, 1900, 0, 0, 0, 0) /* UDP */);
+  ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WSD, 0 /* can_have_a_subprotocol */,
+			  no_master, no_master, "WSD", NDPI_PROTOCOL_CATEGORY_NETWORK,
+			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+			  ndpi_build_default_ports(ports_b, 3702, 0, 0, 0, 0) /* UDP */);
   ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TELEGRAM, 0 /* can_have_a_subprotocol */,
 			  no_master, no_master, "Telegram", NDPI_PROTOCOL_CATEGORY_CHAT,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -2897,7 +2896,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* STARCRAFT */
   init_starcraft_dissector(ndpi_str, &a, detection_bitmask);
 
-  /* TLS */
+  /* TLS+DTLS */
   init_tls_dissector(ndpi_str, &a, detection_bitmask);
 
   /* STUN */
@@ -3215,9 +3214,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* REDIS */
   init_redis_dissector(ndpi_str, &a, detection_bitmask);
 
-  /* UPnP */
-  init_upnp_dissector(ndpi_str, &a, detection_bitmask);
-
   /* VHUA */
   init_vhua_dissector(ndpi_str, &a, detection_bitmask);
 
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index cc1836a9b..cf7a4d0a4 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -202,9 +202,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	total_len = ntohs(*((u_int16_t*) &packet->payload[11])) + 13;
 
 	if(payload_length == total_len) {
-	  /* This is DTLS and the only protocol we know behaves like this is signal */
-	  flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL;
-	  return(NDPI_IS_STUN);
+	  flow->guessed_host_protocol_id = NDPI_PROTOCOL_DTLS;
+	  return(NDPI_IS_NOT_STUN);
 	}
       }
     }
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 1e2027712..9933ca8b2 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -858,7 +858,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct,
 
   // handshake_type = packet->payload[13];
   handshake_len  = (packet->payload[14] << 16) + (packet->payload[15] << 8) + packet->payload[16];
-
+  
   if((handshake_len+25) != packet->payload_packet_len)
     goto no_dtls;
 
@@ -871,7 +871,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct,
   packet->payload = p;
   packet->payload_packet_len = p_len; /* Restore */
 
-  ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
+  ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DTLS);
 
   return(1); /* Keep working */
 }
@@ -895,6 +895,9 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
   printf("[TLS] %s()\n", __FUNCTION__);
 #endif
 
+  if((flow->packet.udp != NULL) && (protocol == NDPI_PROTOCOL_TLS))
+    protocol = NDPI_PROTOCOL_DTLS;
+    
   if((flow->detected_protocol_stack[0] == protocol)
      || (flow->detected_protocol_stack[1] == protocol)) {
     if(!flow->check_extra_packets)
@@ -907,7 +910,7 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
   else
     protocol = ndpi_tls_refine_master_protocol(ndpi_struct, flow, protocol);
 
-  ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_TLS);
+  ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol);
   tlsInitExtraPacketProcessing(ndpi_struct, flow);
 }
 
@@ -1637,8 +1640,8 @@ void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 
   /* *************************************************** */
 
-  ndpi_set_bitmask_protocol_detection("TLS", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_TLS,
+  ndpi_set_bitmask_protocol_detection("DTLS", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_DTLS,
 				      ndpi_search_tls_wrapper,
 				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
diff --git a/src/lib/protocols/upnp.c b/src/lib/protocols/wsd.c
index 1706d021d..8732675b1 100644
--- a/src/lib/protocols/upnp.c
+++ b/src/lib/protocols/wsd.c
@@ -1,7 +1,7 @@
 /*
- * upnp.c
+ * wsd.c
  *
- * Copyright (C) 2018 - ntop.org
+ * Copyright (C) 2018-21 - ntop.org
  *
  * nDPI is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -18,19 +18,21 @@
  *
  */
 
+/* https://en.wikipedia.org/wiki/WS-Discovery */
+
 #include "ndpi_protocol_ids.h"
 
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_UPNP
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_WSD
 
 #include "ndpi_api.h"
 
-#define UPNP_PORT 3702
+#define WSD_PORT 3702
 
-void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
+void ndpi_search_wsd(struct ndpi_detection_module_struct *ndpi_struct,
 		      struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
 
-  NDPI_LOG_DBG(ndpi_struct, "search upnp\n");
+  NDPI_LOG_DBG(ndpi_struct, "search wsd\n");
 
   if(packet->udp
      && (
@@ -40,23 +42,23 @@ void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
 	 (packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000)
 #endif
 	 )
-     && (ntohs(packet->udp->dest) == UPNP_PORT)
+     && (ntohs(packet->udp->dest) == WSD_PORT)
      && (packet->payload_packet_len >= 40)
      && (strncmp((char*)packet->payload, "<?xml", 5) == 0)
      ) {
     NDPI_LOG_INFO(ndpi_struct,"found teredo\n");
-    ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UPNP, NDPI_PROTOCOL_UNKNOWN);
+    ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WSD, NDPI_PROTOCOL_UNKNOWN);
   } else {
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
   }
 }
 
 
-void init_upnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
-			 NDPI_PROTOCOL_BITMASK *detection_bitmask) {
-  ndpi_set_bitmask_protocol_detection("UPNP", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_UPNP,
-				      ndpi_search_upnp,
+void init_wsd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+			NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+  ndpi_set_bitmask_protocol_detection("WSD", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_WSD,
+				      ndpi_search_wsd,
 				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);